GDPR Art.36: Prior Consultation

Build prior consultation triggers into your DPIA process. At the end of every DPIA, include a step that explicitly evaluates whether residual risk remains high after all planned mitigations. If it does, route the DPIA into the prior consultation pathway. Define what "high residual risk" means in your context and apply that threshold consistently. Put together a consultation submission template. Include the completed DPIA, a clear explanation of which processing creates the high risk, the mitigation measures you have already implemented or planned, why those measures are not sufficient to bring risk down, respective controller and processor responsibilities, the DPO's opinion, and any supporting documentation. Make it clear, well-structured, and easy for a regulator to follow. Get to know your lead supervisory authority's process before you ever need it. Understand their submission format, preferred channels, typical timelines, and any specific guidance they have published. Building that familiarity in advance will save significant time when a real consultation arises. Factor the consultation timeline into project planning. The authority has eight weeks, potentially stretching to fourteen. Build this into your project schedule so stakeholders understand that processing cannot begin until the consultation concludes. Surprises here can derail product launches. When the response arrives, document everything and act on it. Implement any recommended changes, update the DPIA, and if conditions are imposed, confirm they are fully in place before processing begins. Keep a complete record of the entire consultation for accountability.